Elhoim

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization flaw allows an authenticated user to submit a `sharing group id` without verification of their authorization to use the referenced Sharing Group. In workflows for creating and editing attributes and Galaxy Clusters, validation was only triggered when the distribution field was explicitly set to 4 (Sharing Group). By omitting the distribution parameter or avoiding this specific condition, a user can bypass the authorization check. This enables a user with permissions to create or modify MISP objects to associate data with an unauthorized Sharing Group, potentially bypassing information-sharing boundaries and resulting in the unauthorized distribution of data to other group members. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An incorrect authorization flaw allows authenticated users to delete attributes from events without possessing the required `perm modify` or `perm modify org` permissions. The issue occurs because the `MispAttribute::deleteAttribute()` function performs organization membership checks but fails to consistently enforce event modification authorization rules. This creates a discrepancy where attribute editing is correctly restricted via `ACL::canModifyEvent()`, but deletion operations can bypass these checks. An authenticated attacker who is a member of the organization owning an event can exploit this to remove individual or bulk attributes, leading to unauthorized modification or loss of threat intelligence data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authentication bypass exists in the LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom `LdapAuthenticate` and `LinOTPAuthenticate` components failed to replicate the credential validation checks of CakePHP's `FormAuthenticate` implementation, allowing empty or non-string values to reach authentication mechanisms. In the LDAP path, an attacker with a valid directory user's email could submit an empty password; if the LDAP server accepts unauthenticated binds via the `ldap bind()` function, the attacker could impersonate the user. In the LinOTP component, invalid credential types were not rejected, and when mixed authentication was enabled, empty passwords could be validated against local hashes. Additionally, LDAP-provisioned accounts could be created with empty local passwords, allowing authentication via the local fallback mechanism if LDAP resolution failed. Successful exploitation allows a remote unauthenticated attacker to impersonate users, potentially gaining administrative access to sensitive threat-intelligence data and system configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An improper TLS certificate validation issue exists in the `CurlClient` component. The `CurlClient::$verifyPeer` property was not explicitly initialized, defaulting to null, which effectively disabled TLS peer verification during cURL operations unless explicitly enabled by the calling code. This allows HTTPS connections to accept certificates not issued by a trusted certificate authority. A man-in-the-middle attack could be performed by an attacker capable of intercepting network traffic between a MISP instance and a remote HTTPS service to impersonate the endpoint. This could lead to the observation of sensitive information, such as authentication material and threat intelligence, or the modification of responses returned to the MISP instance. **Recommendations** Apply the available patch to enable TLS peer verification by default and correct self-signed certificate handling in the `SyncTool` component.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization flaw exists in the OnDemand correlation engine where correlations are calculated based only on matching attribute values, ignoring distribution, sharing group, organization, and other access-control restrictions. This allows an authenticated low-privileged user to receive correlation results for attributes or events they are not authorized to access by querying or creating attributes that correlate with restricted content. The issue stems from the correlation collection path failing to account for the requesting user and the use of potentially stale denormalized access-control information in paths relying on stored correlation data. The system utilizes the `fetchAttributesSimple()` function to evaluate restrictions against live data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** A reflected Cross-Site Scripting (XSS) issue exists in the event attribute filtering query builder. The `taggedAttributes` and `galaxyAttachedAttributes` URL parameters are inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded within a `<script>` element. Because `JsonTool::encode()` uses `JSON UNESCAPED SLASHES`, a value containing a closing `</script>` sequence can terminate the script element and inject arbitrary HTML or JavaScript. An attacker can exploit this by tricking an authenticated user into following a crafted URL, executing malicious JavaScript within the security context of the MISP instance and the victim's session privileges. This may lead to unauthorized data access or modification based on the victim's permissions. **Recommendations** Apply HTML escaping using the `h()` function to both scalar and array values before they are inserted into the DOM. As a temporary mitigation, avoid using the `taggedAttributes` and `galaxyAttachedAttributes` parameters in the event attribute filtering query builder.